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IN THE CLAIMS: 

This listing of the claims replaces all prior versions, and listings, of the claims in 
the application. 

1 . (Original) A method of classifying data traffic in a packet-based 
communications network conveying different classes of data, including the steps of: 

(a) monitoring a communications network for data traffic to identify a sequence of 
data packets of unknown class transmitted between a source address and a destination 
address; 

(b) measuring at least one parameter of at least a significant part of the packet 
sequence, said parameter being any one of: 

- coding attributes of packets in the sequence; 

- type of transport protocol used; 

- type of error protection protocol used; 

- duration of said sequence; and 

- correlation between traffic in said sequence and traffic in a further sequence being 
transported from said destination address back to said source address; 

and 

(c) deriving from the measured parameter a probable classification of the data 
conveyed in the packet sequence. 

2. (Original) A method as claimed in claim 1 where the classification is between 
real-time data traffic and other data in the network. 

3. (Original) A method as claimed in claim 2 wherein the classification 
distinguishes between voice traffic and other traffic. 

4. (Original) A method as claimed in claim 1 wherein the classification 
distinguishes between video traffic and other traffic. 
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5. (Original) A method as claimed in claim 1 where in step (b) a plurality of 
different parameters are measured. 

6. (Original) A method as claimed in claim 1 where in step (c) said classification 
is determined by a combination of processes based on different parameters, the results 
of each process being combined with the others in accordance with a specific weighting. 

7. (Original) A method as claimed in claim 1 where the measured parameter is 
the duration of said sequence, and sequences of longer duration are taken to indicate a 
high probability of real-time traffic. 

8. (Original) A method as claimed in claim 1 wherein the measured parameter is 
correlation between traffic in said sequence and traffic in a further sequence being 
transported from said destination address back to said source address, and correlation 
of periods of activity in one direction with periods of inactivity in the reverse direction is 
taken as an indicator of voice or videoconference traffic. 

9. (Original) A method as claimed in claim 1 wherein a plurality of parameters 
are measured, including timing parameters of individual packets within the sequence. 

10. (Original) A method as claimed in claim 9 where statistical analysis of the 
parameters is used to determine said classification. 

1 1 . (Original) A method as claimed in claim 1 wherein a plurality of parameters 
are measured, including timing parameters of events in the sequence. 

12. (Original) A method as claimed in claim 11 wherein step (c) includes (i) 
deriving from the measured timing parameters one or more statistical properties of 
packet timing during at least a part of the sequence; and (ii) using said statistical 
properties to determine said classification. 
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13. (Original) A method as claimed in claim 12 where said events comprise the 
arrival of each new packet for the sequence under investigation. 

14. (Original) A method as claimed in claim 11 wherein the measured parameters 
include the intervals between events within said sequence. 

15. (Original) A method as claimed in claim 14 wherein the uniformity of said 
intervals over a significant part of the sequence is taken to indicate a high probability of 
real-time traffic. 

16. (Original) A method as claimed in claim 15 wherein the intervals have a 
maximum duration of 20ms. 

17. (Original) A method as claimed in claim 12 wherein the step (c)(i) includes 
filtering events to restrict the events whose measured parameters are included in the 
derivation of said statistical properties. 

18. (Original) A method as claimed in claim 17 wherein said filtering is performed 
so as to eliminate periods of inactivity from consideration in deriving said statistical 
properties. 

19. (Original) A method as claimed in claim 1 wherein said sequence is divided 
for analysis into a sequence of shorter measurement periods, and filtering is performed 
by reference to measurements from one measurement period at a time. 

20. (Original) A method as claimed in claim 19 wherein said period is typically 
100ms. 

21. (Original) A method as claimed in claim 19 wherein the filtering operates to 
omit or delete certain measurements from derivation of statistical properties of the 
measurements, or modifies those measurements and/or the statistical properties in 
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some predetermined way. 

22. (Original) A method as claimed in claim 19 wherein only measurement 
periods preceded by periods containing significant activity are included in subsequent 
analysis. 

23. (Original) A method as claimed in claim 19 wherein the first measurement 
within each measurement period is discarded to eliminate bias in the measurements 
made. 

24. (Original) A method as claimed in claim 19 wherein a separate record of the 
first measurement within each measurement period is kept which is later removed from 
a population for that measurement period. 

25. (Original) A method as claimed in claim 1 wherein the amount of raw data 
obtained by monitoring network traffic is reduced by aggregating data for separate 
measurement periods, and optionally for groups of measurement periods. 

26. (Original) A method as claimed in claim 1 including steps to compensate for 
variations in the packet arrival or other event times caused by outside influences and to 
accommodate specific traffic patterns, such as when the absence of a signal can lead to 
a misinterpretation of the data. 

27. (Original) A method as claimed in claim 26 wherein errors due to the inter- 
packet arrival time are normalised against an expected arrival time. 

28. (Original) A method as claimed in claim 27 wherein an internal time reference 
is compared with arriving data packets so as to measure differences between actual 
arrival times and predicted arrival times. 

29. (Original) A method as claimed in claim 1 wherein said measurement 
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includes further measurements of correlation between parameters of traffic in opposite 
directions of a duplex connection. 

30. (Original) A method as claimed in claim 29 where correlation between 
periods of high traffic in one direction and low traffic in the other are used as an 
indicator of voice traffic. 

31. (Original) A method as claimed in claim 1 wherein additional measurements 
are used to distinguish multiple from single voice circuits and, where a connection is 
carrying multiple voice circuits, to take account of the particular attributes of such a 
connection. 

32. (Original) A method as claimed in claim 1 wherein timestamping of captured 
and re-assembled data packets is carried out on closure of the bit stream representing a 
data packet and written contiguous with the packet. 

33. (Original) A method as claimed in claim 1 wherein the process of 
timestamping packets is carried out separately from the detection and assembling of 
data packets. 

34. (Original) A method as claimed in claim 1 wherein the determined 
classification is used to automatically control configuration of the network. 

35. (Original) A method as claimed in claim 1 further comprising using the 
determined classification to report usage of the network for accounting purposes. 

36. (Original) Apparatus for classifying data traffic in a packet-based 
communications network conveying different classes of data, comprising: 

(a) monitoring means for monitoring a communications network for data traffic to 
identify a sequence of data packets of unknown class transmitted between a source 
address and a destination address; 
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(b) measuring means for measuring at least one parameter of at least a 
significant part of the packet sequence, said parameter being any one of: 

- coding attributes of packets in the sequence; 

- type of transport protocol used; 

- type of error protection protocol used; 

- duration of said sequence; and 

- correlation between traffic in said sequence and traffic in a further sequence being 
transported from said destination address back to said source address; 

and 

(c) classification means for deriving from the measured parameter a probable 
classification of the data conveyed in the packet sequence. 
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